# The download is on claude.ai

2026-09-18

Attackers are hosting infostealer lures on real Claude, ChatGPT, and Grok share links. The domain is legitimate. The paste-into-Terminal step is the payload.

Canonical: https://www.fabiocti.com/notes/download-is-on-claude-ai/
Author: Fabio Correia

People still triage phishing by looking at the URL bar.

That habit is now wrong in a specific way. Huntress spent July watching 29 organizations install a fake Claude Desktop from a public Artifact on the *real* `claude.ai` domain. Anthropic’s own page said the content was user-generated and unverified. The “Download” button then left the platform. What landed was SectopRAT, not an assistant.

A second pattern uses `claude.ai/share`. The conversation is titled like an Apple Support guide for installing Claude on a Mac. It tells the user to open Terminal and paste a curl into zsh. That chain has been dropping MacSync — browser, Keychain, wallets, sometimes a RAT. Zscaler is calling the same class ClaudeFix: ClickFix, hosted on a trusted AI domain.

A third pattern does not need an ad. Shared ChatGPT and Grok conversations for “clear disk space on macOS” got SEO-poisoned into ordinary Google results. Same move: a public share URL on the vendor’s site, a troubleshooting voice, a command you are supposed to run yourself.

## What this is not

It is not a jailbreak of the model. It is not “AI became sentient and wrote malware.” It is a publishing feature. Share links and Artifacts are public pages on a domain the target already trusts. Search engines index them. Ads can point at them. There is no lookalike registrar to notice and no certificate warning to click through.

The operator did not need to compromise Anthropic, OpenAI, or xAI. They needed a share button and a victim who treats `claude.ai` as a support channel.

## The tell is the handoff

A real vendor does not ask a CEO, an EA, or a developer to paste a Base64 blob into Terminal to finish setup.

If the page is on the official domain *and* the next step is Run, Win+R, curl-into-shell, or “allow this unidentified developer,” you are not installing the product. You are volunteering the browser.

That is how you get a stealer log of the personal Gmail and the corporate cookies in the same week — without anyone phish-testing the tenant.

## What to do with the mail / the Slack / the “I just wanted Claude”

Do not run the command to see what it does. Screenshot the share URL. Preserve the browser history if there was a sponsored result. Treat the endpoint as hostile until it is imaged or wiped, the same as any other loader.

Then ask the boring questions. Did they paste it on a work Mac or a home one. Was the company password manager in that browser. Did they also download a “ClaudeDesktop.exe” from a public Artifact. Those are three different scopes.

IT will want to block `claude.ai`. That is the wrong cut. The domain is supposed to exist. The cut is: no unsigned installers from share pages, no shell paste from a chat, no “Apple Support” that lives on a chatbot URL.

If someone in the C-suite already ran it, you are not in awareness-training land. You are in session-revocation land. Pull the log. See whether the cookies still answer. The trusted URL was the packaging. The paste was the breach.